Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2025-7062

Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education

CVSS 4.0 5.2 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2025-7062

Published

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2025-7062

Published

h5p-nodejs-library

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unknown",
                    "modules": [
                        "Import of H5P modules"
                    ],
                    "packageName": "h5p-nodejs-library",
                    "product": "h5p-nodejs-library",
                    "programFiles": [
                        "packages/h5p-server/src/H5PEditor.ts"
                    ],
                    "repo": "https://github.com/Lumieducation/H5P-Nodejs-library",
                    "vendor": "Lumi Education UG",
                    "versions": [
                        {
                            "lessThan": "10.0.4",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON